Sorry, Wrong Number: Debugging a Crash under Wine (2022)

On December 3rd, 2021, a friend sought assistance for a program that crashed while running under Wine. While the issue is often straightforward, this particular case presented no obvious reason why the program should not work. The program utilized MSys2's MinGW-w64 package, compiled with GCC 10.3, and incorporated DLLs such as libpng and zlib.

Debugging efforts revealed that the crash occurred at a call to png_read_info. The last API call before the crash was msvcrt._read, which returned successfully before the application crashed. Subsequent debugging showed that the access violation was an execute, indicating that the program's instruction pointer (RIP) landed in a non-executable memory page, potentially suggesting stack corruption. However, running Wine under Valgrind did not yield any useful insights.

To further investigate, the author employed rr, a debugger capable of recording and replaying program execution. Despite some challenges in setting up rr with Wine and obtaining accurate debug symbols, the replay analysis eventually pinpointed the crash to an explicit CALL instruction directed to an invalid address (0x2fe8f2910).

This was confirmed by disassembling the program, which revealed that the CALL instruction pointed to a completely different address (e8 78 9e 03 00), contradicting the original instruction (e8 20 45 7e 96).

The investigation led to the realization that the .text segment, containing executable code, was marked as read-only. This implies that modifying the CALL instruction would require deliberate re-mapping of the memory page. The author then hypothesized that libpng, a library utilized by the program, was responsible for the anomalous behavior, potentially through a function referred to as sub_3680F1200.

Through string searches within the code, the author stumbled upon a peculiar comment: "Unknown pseudo relocation bit size %d." This hint led the author to delve deeper into the concept of pseudo relocations, a topic left for further exploration.